@rimelight/security 0.0.19 → 0.0.21

package/src/csp.ts

@@ -0,0 +1,106 @@
+import type { SecurityOptions } from "./types"
+
+/**
+ * Builds the Content-Security-Policy header string dynamically for a given request nonce.
+ */
+export function buildCspHeader(options: SecurityOptions = {}, nonce?: string): string {
+  const domain = options.domain || ""
+
+  const imgSources = Array.from(
+    new Set([
+      "'self'",
+      "data:",
+      ...(domain ? [`https://cdn.${domain}`] : []),
+      "https://i3.ytimg.com",
+      "https://www.youtube.com",
+      "https://www.youtube-nocookie.com",
+      ...(options.imgSrc || [])
+    ])
+  )
+
+  const allowTurnstile = options.turnstile !== false
+
+  const connectSources = Array.from(
+    new Set([
+      "'self'",
+      "https://cloudflareinsights.com",
+      ...(allowTurnstile ? ["https://challenges.cloudflare.com"] : []),
+      ...(options.connectSrc || [])
+    ])
+  )
+
+  const frameSources = Array.from(
+    new Set([
+      "https://www.youtube.com",
+      "https://www.youtube-nocookie.com",
+      ...(allowTurnstile ? ["https://challenges.cloudflare.com"] : []),
+      ...(options.frameSrc || [])
+    ])
+  )
+
+  const scriptSources = Array.from(
+    new Set([
+      "'self'",
+      ...(nonce ? [`'nonce-${nonce}'`] : []),
+      "https://static.cloudflareinsights.com",
+      "https://betterlytics.io/analytics.js",
+      ...(allowTurnstile ? ["https://challenges.cloudflare.com"] : []),
+      "'inline-speculation-rules'",
+      // Astro ClientRouter (View Transitions inline script sha)
+      "'sha256-ZuMSxilKU+4KIM8LWna4lqBEKzd6WaiAjz6gamhm7zM='",
+      ...(options.scriptResources || [])
+    ])
+  )
+
+  const styleSources = Array.from(
+    new Set([
+      "'self'",
+      // Astro ClientRouter (View Transitions inline style sha)
+      "'sha256-SKuaOGnks7NAUq37nvw1PfGEE0lOAs5ERbiYRbGFIbw='",
+      ...(options.styleResources || [])
+    ])
+  )
+
+  const defaultDirectives: Record<string, string[]> = {
+    "default-src": ["'none'"],
+    "img-src": imgSources,
+    "font-src": ["'self'"],
+    "connect-src": connectSources,
+    "frame-ancestors": ["'none'"],
+    "frame-src": frameSources,
+    "script-src": scriptSources,
+    "script-src-attr": ["'none'"],
+    "style-src": styleSources,
+    "base-uri": ["'self'"],
+    "form-action": ["'self'"],
+    "object-src": ["'none'"],
+    "manifest-src": ["'self'"],
+    "upgrade-insecure-requests": []
+  }
+
+  if (options.trustedTypes) {
+    defaultDirectives["require-trusted-types-for"] = ["'script'"]
+  }
+
+  // Merge custom directive overrides
+  if (options.directives) {
+    for (const [key, value] of Object.entries(options.directives)) {
+      if (value === false) {
+        delete defaultDirectives[key]
+      } else if (value === true) {
+        defaultDirectives[key] = []
+      } else if (Array.isArray(value)) {
+        defaultDirectives[key] = value
+      } else if (typeof value === "string") {
+        defaultDirectives[key] = value.split(" ").filter(Boolean)
+      }
+    }
+  }
+
+  return Object.entries(defaultDirectives)
+    .map(([directive, values]) => {
+      if (!values || values.length === 0) return directive
+      return `${directive} ${values.join(" ")}`
+    })
+    .join("; ")
+}

package/src/index.ts

@@ -0,0 +1,6 @@
+export * from "./vite"
+export * from "./types"
+export * from "./csp"
+export * from "./middleware/construction"
+export * from "./integration"
+export * from "./turnstile"

package/src/integration.ts

@@ -0,0 +1,51 @@
+import type { AstroIntegration } from "astro"
+import type { SecurityOptions, ConstructionOptions } from "./types"
+import { security } from "./vite"
+
+export interface RimelightSecurityOptions extends SecurityOptions {
+  /**
+   * Construction mode options & route injection settings
+   */
+  construction?: ConstructionOptions & {
+    /**
+     * Whether to automatically inject the construction page route. Defaults to true.
+     */
+    injectRoute?: boolean
+    /**
+     * Pattern to inject for the construction route. Defaults to "/[locale]/construction" or
+     * "/construction".
+     */
+    routePattern?: string
+  }
+}
+
+/**
+ * Astro Integration for Rimelight Security. Integrates Vite security plugins (CSP, SRI) and
+ * automatically injects the construction mode page route.
+ */
+export function rimelightSecurity(options: RimelightSecurityOptions = {}): AstroIntegration {
+  return {
+    name: "@rimelight/security",
+    hooks: {
+      "astro:config:setup": ({ injectRoute, updateConfig }) => {
+        // 1. Inject Construction Page Route by default (unless explicitly disabled)
+        if (options.construction?.injectRoute !== false) {
+          const pattern = options.construction?.routePattern || "/[locale]/construction"
+          injectRoute({
+            pattern,
+            entrypoint: "@rimelight/security/pages/construction.astro"
+          })
+        }
+
+        // 2. Add Vite security plugin
+        updateConfig({
+          vite: {
+            plugins: [security(options)]
+          }
+        })
+      }
+    }
+  }
+}
+
+export default rimelightSecurity

package/src/layouts/ConstructionLayout.astro

@@ -0,0 +1,50 @@
+---
+import SecurityHead from "../components/SecurityHead.astro";
+import SEOHead from "@rimelight/seo/components/SEOHead.astro";
+import UIHead from "@rimelight/ui/components/head/UIHead.astro";
+import RLAMain from "@rimelight/ui/components/main/RLAMain.astro";
+import { siteConfig } from "virtual:rimelight/seo";
+import { Font } from "astro:assets";
+
+export interface Props {
+  title?: string | undefined;
+  description?: string | undefined;
+  favicon?: string | undefined;
+  noindex?: boolean | undefined;
+  class?: string | undefined;
+  bodyClass?: string | undefined;
+}
+
+const {
+  title = "Under Construction",
+  description = "This site is currently undergoing scheduled construction.",
+  favicon,
+  noindex = true,
+  class: className = "",
+  bodyClass = "isolate bg-black"
+} = Astro.props;
+---
+
+<!doctype html>
+<html lang="en">
+  <head>
+    <SecurityHead />
+    <SEOHead
+      title={title}
+      description={description}
+      config={siteConfig}
+      favicon={favicon}
+      noindex={noindex}
+    />
+    <UIHead />
+    <Font cssVariable="--font-sans" preload={true} />
+    <Font cssVariable="--font-serif" preload={true} />
+    <Font cssVariable="--font-mono" preload={true} />
+    <slot name="head" />
+  </head>
+  <body class={bodyClass}>
+    <RLAMain class={className}>
+      <slot />
+    </RLAMain>
+  </body>
+</html>

package/src/middleware/construction.ts

@@ -0,0 +1,315 @@
+import { getCookie, setCookie } from "hono/cookie"
+import type { ConstructionOptions } from "../types"
+
+export const CONSTRUCTION_GUEST_COOKIE = "rimelight-construction-guest"
+
+const DEFAULT_WHITELISTED_PATTERNS = [
+  "/construction",
+  "/api/auth",
+  "/api/construction-guest",
+  "/_astro/",
+  "/_image",
+  "/favicon.",
+  "/robots.txt",
+  "/sitemap",
+  "/.well-known/"
+]
+
+const getPassphrase = (c: any, options?: ConstructionOptions): string | undefined => {
+  if (options?.passphrase) return options.passphrase
+  const envKey = options?.passphraseEnvKey ?? "CONSTRUCTION_PASSPHRASE"
+  return (
+    c?.env?.[envKey] ??
+    (typeof process !== "undefined" ? process.env?.[envKey] : undefined) ??
+    (import.meta as any)?.env?.[envKey]
+  )
+}
+
+const isModeEnabled = (c: any, options?: ConstructionOptions): boolean => {
+  const envKey = options?.modeEnvKey ?? "CONSTRUCTION_MODE"
+  const val =
+    c?.env?.[envKey] ??
+    (typeof process !== "undefined" ? process.env?.[envKey] : undefined) ??
+    (import.meta as any)?.env?.[envKey]
+  return val === "true" || val === true
+}
+
+const encodeBase64Url = (value: Uint8Array): string =>
+  btoa(String.fromCharCode(...value))
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_")
+    .replace(/=+$/, "")
+
+const decodeBase64Url = (value: string): Uint8Array => {
+  const padded = value
+    .replace(/-/g, "+")
+    .replace(/_/g, "/")
+    .padEnd(Math.ceil(value.length / 4) * 4, "=")
+  return Uint8Array.from(atob(padded), (char) => char.charCodeAt(0))
+}
+
+const signHmac = async (payload: string, secret: string) => {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign", "verify"]
+  )
+  return {
+    key,
+    signature: await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(payload))
+  }
+}
+
+const getContextHelpers = (c: any) => {
+  const req = c.req?.raw || c.request || c.req
+  const urlObj =
+    c.url instanceof URL ? c.url : req?.url ? new URL(req.url) : new URL("http://localhost/")
+  const path: string = c.req?.path || urlObj.pathname || "/"
+  const method: string = (c.req?.method || req?.method || "GET").toUpperCase()
+  const search: string = c.req?.url ? new URL(c.req.url).search : urlObj.search || ""
+
+  const redirect = (target: string) => {
+    if (typeof c.redirect === "function") {
+      return c.redirect(target)
+    }
+    const fullTarget = target.startsWith("http")
+      ? target
+      : new URL(target, urlObj.origin).toString()
+    return Response.redirect(fullTarget, 302)
+  }
+
+  const json = (data: any, status = 200) => {
+    if (typeof c.json === "function") {
+      return c.json(data, status)
+    }
+    return new Response(JSON.stringify(data), {
+      status,
+      headers: { "Content-Type": "application/json" }
+    })
+  }
+
+  const getCookieValue = (name: string): string | undefined => {
+    try {
+      const fromHono = getCookie(c, name)
+      if (fromHono) return fromHono
+    } catch {}
+
+    if (c.cookies?.get) {
+      const val = c.cookies.get(name)
+      return typeof val === "string" ? val : val?.value
+    }
+
+    const cookieHeader = req?.headers?.get?.("cookie") || ""
+    const match = cookieHeader.match(new RegExp(`(?:^|; )${name}=([^;]*)`))
+    return match ? decodeURIComponent(match[1]) : undefined
+  }
+
+  return { path, method, search, redirect, json, getCookieValue }
+}
+
+/**
+ * Validates whether the incoming request carries a valid, signed construction guest cookie.
+ */
+export const isConstructionGuest = async (
+  c: any,
+  options?: ConstructionOptions
+): Promise<boolean> => {
+  const cookieName = options?.cookieName ?? CONSTRUCTION_GUEST_COOKIE
+  const helpers = getContextHelpers(c)
+  const token = helpers.getCookieValue(cookieName)
+  const passphrase = getPassphrase(c, options)
+  if (!token || !passphrase) return false
+
+  try {
+    const [encodedPayload, encodedSignature] = token.split(".")
+    if (!encodedPayload || !encodedSignature) return false
+
+    const payload = new TextDecoder().decode(decodeBase64Url(encodedPayload))
+    const { key } = await signHmac(payload, passphrase)
+    const signatureBuffer = decodeBase64Url(encodedSignature)
+    const valid = await crypto.subtle.verify(
+      "HMAC",
+      key,
+      signatureBuffer as unknown as BufferSource,
+      new TextEncoder().encode(payload)
+    )
+    return valid && JSON.parse(payload).expiresAt > Date.now()
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Signs and sets the construction guest cookie on the Hono or Astro context.
+ */
+export const signInConstructionGuest = async (
+  c: any,
+  passphrase: string,
+  rememberMe = true,
+  options?: ConstructionOptions
+): Promise<boolean> => {
+  const expectedPassphrase = getPassphrase(c, options)
+  if (!expectedPassphrase || !passphrase || passphrase !== expectedPassphrase) {
+    return false
+  }
+
+  const cookieName = options?.cookieName ?? CONSTRUCTION_GUEST_COOKIE
+  const maxAge = options?.cookieMaxAge ?? 60 * 60 * 24 * 7 // 7 days
+
+  const payload = JSON.stringify({
+    expiresAt: Date.now() + maxAge * 1000
+  })
+
+  const { signature } = await signHmac(payload, expectedPassphrase)
+  const cookieValue =
+    encodeBase64Url(new TextEncoder().encode(payload)) +
+    "." +
+    encodeBase64Url(new Uint8Array(signature))
+
+  try {
+    setCookie(c, cookieName, cookieValue, {
+      httpOnly: true,
+      secure: true,
+      sameSite: "Lax",
+      path: "/",
+      ...(rememberMe ? { maxAge } : {})
+    })
+  } catch {
+    if (c.cookies?.set) {
+      c.cookies.set(cookieName, cookieValue, {
+        httpOnly: true,
+        secure: true,
+        sameSite: "lax",
+        path: "/",
+        ...(rememberMe ? { maxAge } : {})
+      })
+    }
+  }
+
+  return true
+}
+
+const resolveLocale = (path: string, options?: ConstructionOptions): string => {
+  if (options?.getLocale) {
+    return options.getLocale(path)
+  }
+  if (options?.locales && options.locales.length > 0) {
+    const matched = options.locales.find((loc) => path === `/${loc}` || path.startsWith(`/${loc}/`))
+    if (matched) return matched
+  }
+  // Auto-detection using RFC-5646 language tag pattern at path start (e.g. /en, /en-US, /pt)
+  const match = path.match(/^\/([a-zA-Z]{2}(?:-[a-zA-Z]{2})?)(\/|$)/)
+  return match?.[1]?.toLowerCase() ?? "en"
+}
+
+/**
+ * Universal Construction Mode Middleware for Hono and Astro.
+ *
+ * Intercepts unauthenticated traffic when CONSTRUCTION_MODE is active, handles POST requests to the
+ * guest auth endpoint automatically, and passes authenticated requests or whitelisted assets
+ * cleanly.
+ */
+export function construction(options: ConstructionOptions = {}) {
+  const apiPath = options.apiPath !== undefined ? options.apiPath : "/api/construction-guest"
+  const constructionPath = options.constructionPath ?? "/construction"
+
+  return async (c: any, next: any) => {
+    const { path, method, search, redirect, json } = getContextHelpers(c)
+
+    // 1. Auto-handle API guest authentication endpoint
+    if (apiPath && path === apiPath && method === "POST") {
+      try {
+        let body: any = {}
+        if (typeof c.req?.json === "function") {
+          body = await c.req.json().catch(() => ({}))
+        } else if (c.request) {
+          body = await c.request.json().catch(() => ({}))
+        }
+
+        const signedIn = await signInConstructionGuest(
+          c,
+          body?.passphrase ?? "",
+          body?.rememberMe ?? true,
+          options
+        )
+
+        if (!signedIn) {
+          return json({ error: "Invalid credentials" }, 401)
+        }
+        return json({ success: true })
+      } catch (err: any) {
+        return json({ error: err?.message || "Authentication failed" }, 400)
+      }
+    }
+
+    const enabled = isModeEnabled(c, options)
+    const locale = resolveLocale(path, options)
+
+    const isConstructionPage =
+      path === constructionPath ||
+      path === `/${locale}${constructionPath}` ||
+      path.endsWith(constructionPath)
+
+    // Helper to check user authorization
+    const isAuthorized = async (): Promise<boolean> => {
+      if (options.isAuthorized) {
+        const customAuth = await options.isAuthorized(c)
+        if (customAuth) return true
+      }
+      const session = c.get?.("session") || c.get?.("user") || c.locals?.session || c.locals?.user
+      if (session) return true
+      return await isConstructionGuest(c, options)
+    }
+
+    // 2. If user visits the construction page directly:
+    if (isConstructionPage) {
+      if (!enabled || (await isAuthorized())) {
+        return redirect(`/${locale}`)
+      }
+      return next()
+    }
+
+    // 3. If construction mode is off, proceed normally
+    if (!enabled) {
+      return next()
+    }
+
+    // 4. Built-in and custom whitelist verification
+    const isWhitelisted = DEFAULT_WHITELISTED_PATTERNS.some((pattern) => path.includes(pattern))
+    if (isWhitelisted) {
+      return next()
+    }
+
+    if (options.whitelist) {
+      if (typeof options.whitelist === "function") {
+        if (options.whitelist(path)) return next()
+      } else if (Array.isArray(options.whitelist)) {
+        const match = options.whitelist.some((pattern) =>
+          typeof pattern === "string" ? path.includes(pattern) : pattern.test(path)
+        )
+        if (match) return next()
+      }
+    }
+
+    // 5. Authorized users proceed
+    if (await isAuthorized()) {
+      return next()
+    }
+
+    // 6. Redirect unauthorized users to construction page
+    const redirectTo = encodeURIComponent(path + search)
+    const targetUrl = `/${locale}${constructionPath}?redirect=${redirectTo}`
+
+    if (options.onUnauthorized) {
+      return options.onUnauthorized(c, {
+        locale,
+        path,
+        redirectUrl: targetUrl
+      })
+    }
+
+    return redirect(targetUrl)
+  }
+}

package/src/middleware/dev-only.ts

@@ -0,0 +1,16 @@
+/**
+ * Hono middleware that blocks any path containing `/dev/` in non-development environments. Mount
+ * this early in your Hono app (before API routes and Astro pages) so it covers both `/dev/` page
+ * routes and `/api/dev/` API routes in a single place.
+ *
+ * @example
+ *   // fetch.ts
+ *   import { devOnly } from "@rimelight/security/middleware"
+ *   app.use(devOnly)
+ */
+export const devOnly = async (c: any, next: any): Promise<Response> => {
+  if (!import.meta.env.DEV && c.req.path.includes("/dev/")) {
+    return c.notFound()
+  }
+  return next()
+}

package/src/middleware/index.ts

@@ -0,0 +1,4 @@
+export * from "./security"
+export * from "./dev-only"
+export * from "./construction"
+export * from "./ratelimit"

package/src/middleware/ratelimit.ts

@@ -0,0 +1,120 @@
+import type { RateLimitOptions, RateLimiterBinding } from "../types"
+
+const DEFAULT_SENSITIVE_ROUTES = ["/auth/sign-in", "/auth/sign-up", "/api/upload", "/api/chat"]
+
+/**
+ * Middleware to enforce rate limits on sensitive endpoints using Cloudflare Rate Limiting bindings.
+ *
+ * @example
+ *   // fetch.ts
+ *   import { ratelimit } from "@rimelight/security/middleware"
+ *   app.use(ratelimit())
+ *
+ * @example
+ *   // Custom configuration
+ *   app.use(
+ *     ratelimit({
+ *       routes: ["/api/checkout", "/auth/login"],
+ *       retryAfter: 30,
+ *       bindingName: "MY_RATE_LIMITER"
+ *     })
+ *   )
+ */
+export const ratelimit = (options: RateLimitOptions = {}) => {
+  const {
+    bindingName = "MY_RATE_LIMITER",
+    routes = DEFAULT_SENSITIVE_ROUTES,
+    retryAfter = 60,
+    fallback = "pass",
+    keyGenerator = (c: any) =>
+      c.req.header("CF-Connecting-IP") || c.req.header("x-forwarded-for") || "unknown",
+    onRateLimited = (c: any, retry: number) => {
+      if (typeof c.json === "function") {
+        return c.json(
+          {
+            error: "Too Many Requests",
+            message: "Rate limit exceeded. Please try again later."
+          },
+          429,
+          {
+            "Retry-After": String(retry)
+          }
+        )
+      }
+
+      return new Response(
+        JSON.stringify({
+          error: "Too Many Requests",
+          message: "Rate limit exceeded. Please try again later."
+        }),
+        {
+          status: 429,
+          headers: {
+            "Content-Type": "application/json",
+            "Retry-After": String(retry)
+          }
+        }
+      )
+    }
+  } = options
+
+  return async (c: any, next: () => Promise<any>): Promise<any> => {
+    const path = c?.req?.path || ""
+
+    // 1. Check if the current request matches the rate-limited routes
+    const matchesRoute =
+      typeof routes === "function"
+        ? routes(c)
+        : routes.some((route) =>
+            typeof route === "string" ? path.includes(route) : route.test(path)
+          )
+
+    if (!matchesRoute) {
+      return next()
+    }
+
+    // 2. Resolve the rate limiter binding
+    const bindings = c?.env
+    const limiter: RateLimiterBinding | undefined = options.limiter
+      ? options.limiter(c)
+      : bindings?.[bindingName]
+
+    if (!limiter || typeof limiter.limit !== "function") {
+      // Falls back (fails open/closed according to fallback option)
+      if (fallback === "pass") {
+        return next()
+      }
+
+      if (typeof c.json === "function") {
+        return c.json({ error: "Rate limiter not configured" }, 500)
+      }
+      return new Response(JSON.stringify({ error: "Rate limiter not configured" }), {
+        status: 500,
+        headers: { "Content-Type": "application/json" }
+      })
+    }
+
+    // 3. Extract key and perform rate limit check
+    try {
+      const clientKey = await keyGenerator(c)
+      const { success } = await limiter.limit({ key: clientKey })
+
+      if (!success) {
+        return onRateLimited(c, retryAfter)
+      }
+    } catch (error) {
+      console.error("[Rate Limit Error]", error)
+      if (fallback !== "pass") {
+        if (typeof c.json === "function") {
+          return c.json({ error: "Rate limit check failed" }, 500)
+        }
+        return new Response(JSON.stringify({ error: "Rate limit check failed" }), {
+          status: 500,
+          headers: { "Content-Type": "application/json" }
+        })
+      }
+    }
+
+    return next()
+  }
+}